I have a 2016 Infiniti Q50, which was equipped with an infotainment system called Infiniti InTouch. It consists of two displays (upper and lower), and I have spent the past few weeks reverse engineering it.
I have successfully gained root and done extensive reverse engineering of the Linux system under the hood, including running custom code. However, I am now running into one main problem that has me stumped. Sorry for the long read, but I want to leave as many details as possible for you all in hopes of going in the right direction.
Here's a brief overview of the system so you guys can get familiarized. My test bench is only the DCU (the actual head unit) and the integral switch (remote lower display & buttons)
- DCU (Display Control Unit): The DCU is the "brains" of the system, referred in the factory service manual as "InTouch Master". It has an Intel Atom processor and boots from a microSD card located on the front of the board.
- Integral Switch: The lower screen and all of the buttons and knobs on the assembly (HVAC, Radio Controls, Seat Heater Buttons). It also connects to the center console "multifunction switch" that has a knob and some buttons. Communicates with the DCU via AV Comm CAN circuit and gets lower screen image data via LVDS using a TI chipset.
- Combination Meter: The gauge cluster. Communicates via AV Comm with CAN ISO-TP messages for song information & navigation heads up. Communicates with DCU via AV Comm CAN circuit.
- NAVI Control Unit: The navigation control unit that runs the navigation software and pipes video output to the upper display via LVDS. It runs Windows CE and communicates with the DCU via USB. Not too interested in this personally.
- Telematics Control Unit: The cellular connected module that provides remote start/stop/unlock and internet connectivity for the DCU. Communicates with the DCU via USB.
- AV Control Unit: The CD player & stereo system. On the base model, it amplifies audio to the speakers. On models with BOSE audio systems, it sends preamp output to the BOSE amplifier.
A blast from the past, this head unit runs Meego linux, with some kind of hybrid Android subsystem based on Android x86 (2.2). When the system boots, the proprietary Infiniti head unit software (carwings) shows on both displays, but once Android is ready the lower display switches to the Android launcher.
The Linux partition is read only, but the software and persistent storage is in another partition called naviwork, which is mounted to /home/naviwork/ at boot.
Relevant Command Outputs
Here are some command outputs that give a feel for the system and it's configuration (GitHub Gist Raw Links):
- # w (the logan user is me on ttyUSB0, there is no apparent user logged in for the infotainment software)
- # ps afx
- # lsusb/lsusb -v
- # lcpci -vvv
- # ls /dev
- List of kernel modules
Relevant Additional Info
Login Release Info:
MeeGo release 1.2.0 (MeeGo) Kernel 126.96.36.199-35.1_DLK0041-android-intel-crossville_lapis-fastboot on an i686
While there are zero web results for anything on this system, I did find some references to GENIVI's reference architecture that are consistent with this system. Plus, DENSO (the manufacturer of the head unit) is a member of GENIVI.
While I have successfully gotten custom code running, I cannot figure out how to get access to the displays. I have not found any evidence of a shell or desktop environment, and all of the head unit software runs as root (except the Android system which runs as androids). I also have only found remnants of X11 (but no running X server), and no evidence of Wayland, so I have no clue how the display is drawn or how to get custom applications shown.
What tools or steps can I take to move forward? I have full root access, and I also have an image of the entire boot drive which I can also modify. I am also able to provide any further command output, file trees, or information needed.